Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-cc94-hwj3-rf65
Advisory ID github_osv/GHSA-cc94-hwj3-rf65
Aliases CVE-2013-1835
Summary Moodle's login_as feature leaks information from external repositories Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
generic_textual LOW
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36426
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
http://openwall.com/lists/oss-security/2013/03/25/2
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/31581ae65df05ea64031ac24c8b8f817414f1379
https://github.com/moodle/moodle/commit/6153c8040dd6ecdf03070ad6b538845c263bf722
https://github.com/moodle/moodle/commit/ded4050f1bb050770df3bc8e78dcfadf815011ea
https://moodle.org/mod/forum/discuss.php?d=225347
CVE-2013-1835 https://nvd.nist.gov/vuln/detail/CVE-2013-1835
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.